Malicious PDF — malware analysis report

Static analysis result for SHA-256 98f170675d76b392…

MALICIOUS

PDF

18.1 KB Created: 2019-05-01 17:20:44 +01:00 Authoring application: mPDF 5.7
MD5: 41f34cf6d63d6d59db4c39030e5babf8 SHA-1: f795481cbac0e562a74cab58aa24d4f4d9640bbc SHA-256: 98f170675d76b392d6ee571f2fb95b0f0368713cdd03faaa2fb1228b66c93451
60 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment

The PDF document contains a large number of embedded external links, forming a link farm. The primary heuristic indicates this is a technique to obscure malicious intent by directing users to a vast collection of other PDFs. While the specific URLs themselves are currently marked as benign, the sheer volume and structure suggest a malicious intent to drive traffic or potentially host malicious content on a large scale. No scripts were extracted from this sample.

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://loaminoo.linkpc.net/1090098094099099094/Das-Gest-ndnis-des-Valentin-Rosenthal-Elirium-Saga-0-by-Leveret-Pale.pdf
    • http://loaminoo.linkpc.net/1090093098096093091/Korporatismus-in-Der-Brd---Von-Der-Konzertierten-Aktion-Zum-B-ndnis-F-r-Arbeit-by-Gero-Birke.pdf
    • http://loaminoo.linkpc.net/1091090094099091096/1-Ring-gelbes-Metall-333-gest-Dokumentarischer-Roman-IIa-by-Roland-Behrmann.pdf
    • http://loaminoo.linkpc.net/8095097090094098/Pale-Companion-Pale-2-by-Mac-Flynn.pdf
    • http://loaminoo.linkpc.net/8095097093092090/The-Pale-The-Pale-Series-by-A-D-Wittman.pdf
    • http://loaminoo.linkpc.net/8095097091095093/Pale-Lover-Pale-3-by-Mac-Flynn.pdf
    • http://loaminoo.linkpc.net/3099092096/Textbook-Amy-Krouse-Rosenthal-by-Amy-Krouse-Rosenthal.pdf
    • http://loaminoo.linkpc.net/7093094097099092/Valentin-s-Job-Appliances-by-Tom-Berry.pdf
    • http://loaminoo.linkpc.net/7093094096091090/John-s-LOVE-by-J-J-Valentin.pdf
    • http://loaminoo.linkpc.net/3094094093099094/Live-and-Remember-by-Valentin-Rasputin.pdf
    • http://loaminoo.linkpc.net/9097090096098098/Detektive-amp-Drachen-by-Marc-E-Valentin.pdf
    • http://loaminoo.linkpc.net/1091096099091091093/Pinball-Wizard-by-Valentin-Lippert.pdf
    • http://loaminoo.linkpc.net/7093094097090097/Help-Wanted-Assignment-Romance-2-by-Barbara-Valentin.pdf
    • http://loaminoo.linkpc.net/8095095098095098/Treasures-of-Bruges-by-Hugo-Maertens-Valentin-Vermeersch.pdf
    • http://loaminoo.linkpc.net/1091099097090096099/The-Holocaust-in-the-Painting-of-Valentin-Lustig-by-Edith-Balas.pdf
    • http://loaminoo.linkpc.net/9098097096094/Nuestra-historia-de-amor-de-fracaso-hasta-San-Valent-n-by-Athira-Bhargavan.pdf
    • http://loaminoo.linkpc.net/1090092096093095095/Das-Verfassungsbild-in-Der-Christianopolis-Des-Johann-Valentin-Andreae-by-Sixt-Alexander-Seewald.pdf
    • http://loaminoo.linkpc.net/8096099098093094/Evolution-Entwicklung-und-Organisation-in-der-Natur-das-Bozner-Treffen-1993-by-Valentin-Braitenberg.pdf
    • http://loaminoo.linkpc.net/7093094095092096/I-ll-Never-Change-My-Name-An-Immigrant-s-American-Dream-from-Ukraine-to-the-USA-to-Dancing-with-the-Stars-by-Valentin-Chmerkovskiy.pdf
    • http://loaminoo.linkpc.net/5091097095097095/Yes-Day-by-Amy-Krouse-Rosenthal.pdf
    • http://loaminoo.linkpc.net/9097090096098098/Detektive-amp-Drachen-by-Marc-E-Valenti

Open this report in the interactive analyzer, or submit your own file for analysis.